7ed20d7a8f61ce7efb5354bdf8e02b6f3cefa418f8adb9e6d81f70086102e5e8

Resubmissions

28/08/2022, 23:26

220828-3e8ymagabq 5

10/06/2021, 11:42

210610-j9y37a6cma 5

10/06/2021, 11:31

210610-k9s461t52a 5

Analysis

max time kernel
138s
max time network
119s
platform
windows10_x64
resource
win10v20210408
submitted
10/06/2021, 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.exe
Size

2.3MB
MD5

84ffb87cc91d697db2f5685df68de7af
SHA1

4f0360d60b685ed6059d32aef24c6b3cbbd46e9e
SHA256

10bba07a1965c61a2ec05b46331e3eeda3d7bdeb8074c86009dc11f2564048fa
SHA512

c6b178f37b2318b4eeaf1e151cac70a10b0be8eeb0e8153bd324a66314a33dca27e43254518a4b2db2ed5cab31ff836e0fa84e2a8112b67772409d77f39d5e9f

Score

5^/10

ransomware

Malware Config

Signatures

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\Notify.jpg"	sample.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop\WallpaperStyle = "6"	sample.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\Desktop\TileWallpaper = "0"	sample.exe

C:\Users\Admin\AppData\Local\Temp\sample.exe
"C:\Users\Admin\AppData\Local\Temp\sample.exe"
1⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
PID:652

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact